Data Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

HEYMLAW
Rechtsanwalt Robert A. Heym
Neuhofweg 14
82229 Seefeld-Hechendorf

phone: +49 175 5852500
E-Mail: info@heymlaw.de

No data protection officer has been appointed as there is no legal obligation to do so.

Website Provision and Hosting

This website is hosted by STRATO AG.

When you visit this website, the hosting provider automatically collects and stores information in what are known as server log files. This includes, in particular:

  • IP-address
  • date and time of access
  • Browsertype and browserversion
  • operating system used
  • referrer-URL
  • pages viewed

This data is processed to ensure the technical functionality, stability and security of the website.

The legal basis is Article 6(1)(f) of the GDPR.

Getting in Touch

If you contact us by email or via a contact form provided on this website, the personal data you provide will be processed solely for the purpose of dealing with your enquiry.

Processing is carried out on the basis of Article 6(1)(b) of the GDPR, provided that the enquiry relates to the conclusion or performance of a contract or a client relationship. In all other cases, processing is carried out on the basis of Article 6(1)(f) of the GDPR.

Client Acquisition and Client Management

We process personal data for the purposes of establishing, carrying out and managing client relationships.

These include, in particular:

  • Master data
  • Contact data
  • Communication data
  • Client details
  • Billing details
  • any other information required to manage the matter

The legal basis is Article 6(1)(b) of the GDPR.

Where special categories of personal data are processed, this is done on the basis of Article 9(2)(f) of the GDPR.

Use of Microsoft 365

We use Microsoft 365 for our firm’s organisation and communication, in particular:

  • Outlook / Exchange Online
  • SharePoint
  • OneDrive
  • Microsoft Office-applications

Data is processed for the purposes of handling client matters, communicating with clients and for internal firm administration.

The legal basis is Article 6(1)(b) and (f) of the GDPR.

Use of the CLIO Legal Practice Management Software

We use the legal practie management software application CLIO to manage cases, deadlines, contacts, documents and billing data.

The data is processed solely for the purpose of providing legal services in accordance with the law.

The legal basis is Article 6(1)(b) of the GDPR.

Use of Artificial Intelligence

AI-powered systems can be used to support legal research, document drafting and internal work processes.

Client-related personal data is not processed in external AI systems unless clients have given their express consent in advance or there is another legal basis for doing so.

The legal basis is Article 6(1)(f) of the GDPR and, where applicable, Article 6(1)(a) of the GDPR.

Recipients of Personal Data

Personal data will only be disclosed where this is necessary for the performance of the mandate or in accordance with legal obligations.

Recipients may include, in particular:

  • Courts
  • Public authorities
  • Opponents and their legal counsel
  • tax advisors
  • auditors
  • IT-providers
  • Hosting-providers
  • Microsoft
  • CLIO

Where necessary, data processing agreements have been entered into in accordance with Article 28 of the GDPR.

Data Transfers to Third Countries

When using individual IT service providers, personal data may be transferred to countries outside the European Union.

Where service providers are certified under the EU-US Data Privacy Framework, the transfer takes place on that basis.

In addition, standard contractual clauses or other appropriate safeguards are used in accordance with Article 46 of the GDPR.

Retention Period

Personal data is only stored for as long as is necessary for the relevant processing purposes or as required by statutory retention obligations.
Insbesondere gelten folgende gesetzliche Aufbewahrungsfristen:

  • 6 years in accordance with commercial law
  • 10 years under tax law

Once the relevant retention periods have expired, data will be deleted unless there is a further legal basis for its storage.

Social Media Presence

This website may contain links to our social media profiles, in particular LinkedIn.

Simply visiting our website does not result in any automatic transfer of data to these networks.

Data will only be transmitted once you have actively clicked on the relevant link.

The respective providers are solely responsible for data processing on their platforms.

Rights of Data Subjects

You are entitled to:

  • Information pursuant to Article 15 of the GDPR
  • Rectification pursuant to Article 16 of the GDPR
  • Erasure in accordance with Article 17 of the GDPR
  • Restriction of processing pursuant to Article 18 of the GDPR
  • Data portability in accordance with Article 20 of the GDPR
  • Objection pursuant to Article 21 of the GDPR
  • Withdrawal of consent given in accordance with Article 7(3) of the GDPR

Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority.

Competent supervisory authority:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27
91522 Ansbach

Contact

If you have any questions regarding data protection, please do not hesitate to contact us:

HEYMLAW
Rechtsanwalt Robert A. Heym
E-Mail: info@heymlaw.de
Phone: +49 175 5852500

Last Update

01.06.2026